Enhancing Adversarial Robustness Through Robust Information Quantities

Dear Reviewer StKw,

We deeply appreciate your detailed and positive reviews to our work. Please find our answers below in response to your concerns.

Replies to Weaknesses

1. It appears to apply conditional mutual information from paper [1] to the field of model robustness, so a clearer explanation of the paper's novel contributions would be beneficial.

Clearly there is misunderstanding here. This paper is very novel. There is huge difference between robust CMI, robust separation, and robust NCMI proposed in this paper, and their clean counterparts CMI, separation, and NCMI in [1].

The concepts of CMI, separation, and NCMI in [1] are defined for clean, original data samples. Since original data samples are given, these information quantities can be computed directly via analytical formulas.

In contrast, the concepts of robust CMI, robust separation, and robust NCMI we proposed in this paper are meant to measure robust mapping structural properties of a DNN against all possible attacks on the original data samples. Since we need to handle all possible attacks on original data samples under a given attack budget, the attacked inputs to the DNN are actually unknown. Each of these proposed robust information quantities is defined through an optimization problem (see Equations (25) to (27) on Page 6). Given any original dataset, there is no simple analytical formula for computing each of them. One has to develop optimization algorithms for computing them numerically. This is why we need Theorem 2 on Pages 6 and 7.

For people who know information theory and lossless/lossy compression, here is the analogy. The difference between our proposed information quantities in this paper and the information quantities in [1] is similar to that between Shannon entropy and rate distortion function or that between lossless compression and lossy compression.

2. It would strengthen the evaluation if the black-box attacks also be included as a metric to assess the robustness of a model.

Thanks for your valuable advice. Please kindly check our experimental results presented in Appendix I.3 for detail. For your convenience, we presented the results of our approach and baseline methods on original CIFAR-10 dataset against Square attack when the underlying DNN model is PreAct-ResNet18 here, where models trained by our approach are more robust than the corresponding baseline methods.

3. Appendix F presents the adversarial results against different perturbation budget, it would be better if TRADES and MART are also included as baseline models in this figure.

Thanks for your feedback. We have updated the results in Appendix F, and included TRADES and MART as the baseline models alongside Vanilla AT. In our results, our approach is more robust than plain methods of TRADES and MART against selected perturbation budgets, where we achieve maximum robust accuracy gain of 0.84% and 1.08% for TRADES and MART, respectively. Please kindly check that section.

4. How are the default settings for hyper-parameters $\alpha$ and $\beta$ determined?

Thank you for your question. In our setup, we firstly determined the value of $\alpha$ for each of our selected DNN model by choosing the optimal $\alpha=\alpha^*$ which yields the best robust performance when $\beta$ is fixed at 0. Subsequently, we set $\alpha = \alpha^*$ and search for the best $\beta = \beta^*$ that achieves the best robust performance. Eventually, we treat $(\alpha^*, \beta^*)$ as our optimal hyper-parameter setting. Note that both values of $\alpha$ and $\beta$ are selected from the set [0.001, 0.01, 0.1, 1, 2, 5].

Replies to Questions

1. Additionally, would it be possible to move the visualization and pseudo-code from the appendix to the main text.

Thanks for your suggestion. It is our original intention to include both sections of visualization and pseudo-code in the main body. However, due to the requirement of ICLR conference, doing so may make our paper exceed the page limit. Hopefully you can understand this.

We thank you again for your time and effort to review our paper. If our responses above address all your concerns, could you kindly increase your score to a higher level.

Thank you for the response. The authors clarified the differences between normal CMI, separation, NCMI, and their proposed robust quantities. The evaluation against black-box attacks demonstrates the method's performance. The response addressed my concerns, and I will maintain my positive rating.

Dear Reviewer uHbR,

Thank you for your detailed and thoughtful reviews. Please find our answers below in response to your concerns.

Replies to Weaknesses (Part 1)

1. The experimental improvement does not seem significant in Table 1 and 2. In a few cases, it even decreases more on clean accuracy compared to the increase in robust accuracy.

Thank you for your comment. While we acknowledge that our improvements are not always significant, our key messages and contributions are as follows:

First, our improvements are consistent across models, datasets, and different benchmark methods. Given that we are not motivated to improve any specific method, this is no small feat. Our method is motivated by investigating robust information geometrical properties of DNNs, generic, orthogonal to state-of-the-art benchmark methods, and of plug-and-play nature.

Second, since the capacity of our selected WRN models are quite large, it would be more difficult to improve the performances of such models than models with smaller capacity. In addition, the improvement of our method is more significant when the number of classes in a given dataset increases. This is because that there is more structural information encapsulated in DNN's output probability distribution space when the number of classes of a dataset is high, so there will be more room for the robust NCMI to be minimized. In the case of CIFAR-10, the number of classes is small; so the room for us to improve is also small.

Third, more importantly, our major contributions lie in the introduction of robust structural properties of DNNs as defined by our new robust information quantities: robust conditional mutual information (CMI), robust separation, and robust normalized CMI (NCMI). These are new robust metrics different from robust error rate. The main purpose of our paper is to show that by constraining and controlling these structural quantities during the training process, we can not only improve the normal robust accuracy consistently across models and datasets, but also achieve other fringe benefits such as those reported in Appendix F in terms of robustness against other variations.

2. This paper does not include enough baselines, only TRADES and MART are included. There are many papers that use MI to improve adversarial robustness, such as HBaR, VIB, and IB-RAR.

Thank you for mentioning this. We have selected some of the above methods to compare with ours. Please kindly find our experimental results in Appendix I.4 for detail. For your convenience, we also present the results here. Note that we report results for the best checkpoints obtained for each method on original CIFAR-10 dataset when the underlying DNN architecture is ResNet18.

Dear Reviewer nVqT,

We are sincerely thankful to your insightful comments and reviews. Please find our responses to your concerns below.

Replies to Weaknesses (Part 1)

1. Authors state that data which are near the decision boundary are in general more susceptible, and then introduce the definition of proposed metrics. However, how does the proposed defense solve this problem? Providing additional analyses about it may be better.

Thank you for pointing this out. In response to this question, please kindly refer to Appendix G, where we visualized the simplex of DNN probability outputs. The subplot titled `$\alpha=0$, $\beta=0$' in Fig. 5 represents the output of baseline method (Vanilla AT), where the rest of subplots in Fig. 5 and 6 are visualizations of models trained with our approach. When we fix the hyper-parameter $\alpha=1$, and $\beta$ is set to 2 or 5, the overlapping areas in the simplex among different classes are smaller than that of the baseline method, as we enforce (1) data points to be more concentrated around the centroid of corresponding cluster and (2) different clusters to be more separated with each other. In other words, less data points are near the decision boundaries and susceptible against adversarial attacks under our proposed framework comparing with baseline, and enhances the robustness of a model in general.

2. In Table 2, why the smaller model WRN-28-10 was used for the larger dataset containing synthetic data instead of using the larger WRN-34-10? Please provide explanations for such an inconsistency.

Thanks for bringing this out, and we would love to clear this confusion for you. In the original literature of all our selected baseline methods, they tested their methods with WRN-34-10 on original dataset(s), while prior literature utilizing additional synthetic data to improve robustness mostly adopted WRN-28-10 to conduct their experiments (e.g., [1-3]). We trying to make a fair comparison with these methods by following their settings. Another reason that training a smaller WRN-28-10 model on larger datasets is in consideration of training time, as training on such datasets is generally more computationally expensive.

[1] Rebuffi, S., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T. A. Fixing data augmentation to improve adversarial robustness.

[2] Gowal, S., Rebuffi, S., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T. A. Improving robustness using generated data.

[3] Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., and Yan, S. Better diffusion models further improve adversarial training.

Dear Reviewer nVqT,

We sincerely appreciate you for your time and effort as well as your additional feedback. Please kindly find our further responses below.

As requested, we have revised our Introduction section to address your first concern (Please see texts written in blue in Introduction). For your second concern, we have conducted experiments on CIFAR-{10,100} datasets plus additional 1M synthetic data with WRN-34-10. Due to the limited time we have, we only tested our method combining with vanilla AT and TRADES, where the conclusion is similar to that when the underlying DNN model is WRN-28-10 as reported in Table 2. Our approach consistently outperform each baseline method. Please find our results below:

Results of WRN-34-10 on CIFAR-10 with 1M Synthetic Data:

Results of WRN-34-10 on CIFAR-100 with 1M Synthetic Data:

For the results of the last checkpoint, we additionally evaluate on original CIFAR-100 and present the results below. We argue that the improvements are more significant than those on original CIFAR-10. This is because that there is more structural information encapsulated in DNN's output probability distribution space when the number of classes of a dataset increases, so there will be more room for the robust NCMI to be minimized. In the case of CIFAR-10, the number of classes is small; so the room for us to improve is also small. As the number of classes increases to 100 for CIFAR-100, the room for us to improve is larger. We present the results for last checkpoint on original CIFAR-100 below for your reference.

Results of PreAct-ResNet18:

Results of WRN-34-10:

We genuinely hope our responses have further alleviated your concerns. If that is the case, we wonder if you could kindly reconsider about giving us a higher rating?

Dear Reviewer dKSG,

We genuinely thank your time and effort as well as your positive comments to our paper. Below please find our point-to-point replies to your mentioned weakness and questions.

Replies to Weaknesses

1. While the improvement in results is consistent, it is often quite small. For example, the best AA accuracy for CIFAR-10 with WRN is improved by only about 0.25%.

We acknowledged this point. However, this should be judged from two complementary perspectives.

First, since the capacity of our selected WRN models are quite large, it would be more difficult to improve the performances of such models than models with smaller capacity. In addition, the improvement of our method is more significant when the number of classes in a given dataset increases. This is because that there is more structural information encapsulated in DNN's output probability distribution space when the number of classes of a dataset is high, so there will be more room for the robust NCMI to be minimized. In the case of CIFAR-10, the number of classes is small; so the room for us to improve is also small.

Second, more importantly, our major contributions lie in the introduction of robust structural properties of DNNs as defined by our new robust information quantities: robust conditional mutual information (CMI), robust separation, and robust normalized CMI (NCMI). These are new robust metrics different from robust error rate. The main purpose of our paper is to show that by constraining and controlling these structural quantities during the training process, we can not only improve the normal robust accuracy consistently across models and datasets, but also achieve other fringe benefits such as those reported in Appendix F in terms of robustness against other variations.

2. Given the iterative nature of the algorithm, it would be useful to know the time complexity of training relative to baseline methods.

You probably did not check our Appendix E. The time complexity comparison was provided in our Appendix E on Page 18. In comparison with vanilla AT, TRADES, and MART, our Algorithm 1 and Algorithm 2 require roughly 60% and 120% more training time in our setup, whereas TRADES-AWP requires roughly 30% more training time.